Data Processing Addendum

1. Roles

• The Customer is the controller (or "business") for Customer Personal Data and decides why and how it is processed. WashConsole is the Customer's processor (or "service provider").
• WashConsole is a controller only for the information our Privacy Policy describes as our own, such as account, sign-in, billing and usage information.

2. Processing Only on Instructions

• We process Customer Personal Data only to provide, secure and support the Service, and as the Customer instructs. The Terms, this DPA, and the Customer's settings and use of the Service are its instructions.
• We will tell the Customer if we believe an instruction breaks the law, and we may decline to follow it.
• If the law requires us to process Customer Personal Data in another way, we will tell the Customer first, unless the law forbids it.

3. Details of the Processing

Annex A describes the processing: its subject, duration, purpose, the people concerned and the types of data.

4. Service Provider Commitments

We will not:

• sell or share Customer Personal Data, as the California Consumer Privacy Act and similar state laws define those terms;
• retain, use or disclose it for any purpose, including any commercial purpose, other than providing the Service as this DPA describes;
• retain, use or disclose it outside our direct business relationship with the Customer; or
• combine it with personal information we receive from anyone else or collect ourselves, except as those laws permit.

We will comply with the privacy laws that apply to us as a processor, give Customer Personal Data the level of privacy protection those laws require, and tell the Customer if we can no longer meet these commitments. The Customer may then take reasonable steps to stop and fix any unauthorized use. We understand these restrictions and will comply with them.

5. Confidentiality

Anyone working for WashConsole, as an employee or a contractor, who can access Customer Personal Data is bound to keep it confidential and may access it only as their work requires.

6. Security

We maintain the security measures in Annex B and will not reduce the overall protection they provide during the Customer's subscription.

7. Security Incidents

If we confirm a breach of security that leads to unauthorized access to, or the loss, alteration or disclosure of, Customer Personal Data, we will notify the Customer without undue delay. We will give the Customer the information it reasonably needs to meet its own notice obligations as that information becomes available, and we will take reasonable steps to contain the breach and limit its effects.

8. Subprocessors

• The Customer authorizes us to use the subprocessors listed in Annex C.
• We require each subprocessor, by written contract, to protect Customer Personal Data in line with this DPA, and we remain responsible for its work.
• We will update Annex C and email account owners at least 30 days before a new subprocessor begins to process Customer Personal Data.
• If the Customer objects to a new subprocessor on reasonable data protection grounds, we will discuss it in good faith. If we cannot resolve the objection, the Customer may cancel and receive a refund of any fees it prepaid for the rest of its billing period.

9. The Customer's Responsibilities

The Customer is responsible for the lawfulness of the Customer Personal Data and of its instructions, including giving the notices and obtaining the consents that Section 13 of the Terms requires.

10. Requests From Individuals and Other Help

• If a person contacts us about Customer Personal Data, we will refer them to the Customer and will not answer the request ourselves unless the Customer asks us to or the law requires it.
• The Service lets the Customer view, correct, export and delete most data itself. Where it does not, we will help the Customer respond to requests from individuals.
• We will give reasonable help with the Customer's data protection assessments and with inquiries from regulators about the processing.

11. Export and Deletion

• Ending a subscription does not delete data. While we still hold it, the account owner can ask us for an export of the account's data, and we will provide it within 30 days of the request.
• When the account owner asks us to delete the account, we delete Customer Personal Data from our active systems, ordinarily within 30 days after the 48-hour period in which the request can be cancelled. Copies in our backups are deleted automatically within 100 days.
• We may keep data the law requires us to keep, or that is subject to a legal hold, and it stays protected under this DPA for as long as we keep it.

12. Information and Audits

Once a year, or after a security incident, the Customer may ask us in writing for the information reasonably needed to show that we comply with this DPA, and we will answer within a reasonable time. Any further audit must be agreed in advance, take place at reasonable times, be at the Customer's cost and be subject to confidentiality.

13. AI Features

When an AI feature processes Customer Personal Data, we use the AI provider's paid service, whose terms do not let the provider use the data to improve its models. We do not use Customer Personal Data to train general-purpose AI models. AI output in the Service supports the Customer's decisions and does not make final decisions about any person (Section 14 of the Terms).

14. Where Data Is Processed

We store Customer Personal Data in the United States. Subprocessors may process it in other countries where they operate, under contracts that protect it.

15. Liability, Precedence and Duration

Each party's liability under this DPA is subject to the limitations in the Terms. If this DPA conflicts with the Terms about Customer Personal Data, this DPA controls. This DPA applies for as long as we process Customer Personal Data for the Customer.

Annex A: Details of the Processing

• Subject and duration: providing the Service, for the Customer's subscription and afterwards until the data is deleted as Section 11 describes.
• Nature and purpose: hosting, storing, organizing, displaying, analyzing and sending Customer Personal Data to provide the features of the Service as the Customer sets them up.
• People concerned: the Customer's employees, contractors and other Users; job applicants; the Customer's own customers, such as people who file complaints, leave reviews or join the Customer's messaging lists; and anyone else the Customer chooses to record.
• Types of data: contact and profile details; time clock records, including the device's location at each clock-in and clock-out, and clock-in photos where the Customer turns them on; schedules and time off; pay rates and payroll information; personnel records; training records; messages, photos and videos; complaint, vehicle and claim details, including the last four digits of a payment card; camera footage; public reviews; and connected-device data.
• Sensitive data: depending on how the Customer uses the Service, government identification numbers (for example, on tax forms), health and injury information, precise location at clock-in and clock-out, and photos. These are protected by the measures in Annex B.

Annex B: Security Measures

• Encryption of data in transit (HTTPS/TLS) and at rest.
• Hosting on Google Cloud in the United States.
• Access to data by role and site, enforced by security rules on our servers, and audit logs of sensitive actions.
• Private storage for sensitive files such as clock-in photos, which are shown only through short-lived links.
• Passwords handled by Firebase Authentication, optional two-step verification, and kiosk PINs stored as one-way hashes with a lockout after repeated wrong attempts.
• App Check verification on sensitive server functions, so that they accept requests only from our own apps.
• Error reports scrubbed of credentials before they leave the app, and session replays that mask all on-screen text.
• Point-in-time recovery of the database for 7 days, and daily backups kept for 98 days.

Contact

Washconsole LLC, 12022 Sprite Lane, Orlando, FL 32832, United States · contact@washconsole.com · (412) 927-4677